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Volume I: Assessment Report 
1.0 Authorization and Notification 

The NASA Engineering and Safety Center (NESC) was requested to support the Explosion/Blast 
Dynamics for Constellation Launch Vehicles Assessment Review. This assessment was 
approved out-of-board on June 4, 2007 by Mr. Ralph Roe, NESC Director. This assessment was 
led by Mr. Mel Baer, Sandia National Laboratories (SNL) Senior Scientist, and co-led by Mr. 
Clint Cragg, NESC Principal Engineer. The Assessment Plan was approved by the NESC 
Review Board (NRB) on January 30, 2008. The key stakeholders for this assessment 
methodology are Ray Silvestri and Leo Langston of Johnson Space Center (JSC). 

The NESC team was tasked to perform an independent review of data and provide consultation 
on the following: 

1 . The team was asked to provide recommendations for quantitative characterization of a 
potential blast environment resulting from an inadvertent release of liquid fuel and 
oxidant based on the current Ares-1 configuration and feasible failure causes (both 
supplied by NASA). 

2. The team was also asked to describe best practices procedures to enable 
characterization of most likely explosion environments of the Ares-1 Crew Launch 
Vehicle. 
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4.0 Executive Summary 

An assessment methodology is developed to guide quantitative predictions of adverse physical 
environments and the subsequent effects on the Ares-1 crew launch vehicle associated with the 
loss of contaimnent of cryogenic liquid propellants from the upper stage during ascent. 
Development of the methodology is led by a team at SNL with guidance and support from a 
number of NASA personnel. The methodology is based on the current Ares-1 design and feasible 
accident scenarios. These scenarios address contaimnent failure from debris impact or structural 
response to pressure or blast loading from an external source. Once containment is breached, the 
envisioned assessment methodology includes predictions for the sequence of physical processes 
stemming from cryogenic tank failure. The investigative techniques, analysis paths, and 
numerical simulations that comprise the proposed methodology are summarized and appropriate 
simulation software is identified. 

5.0 Assessment Plan 

The assessment methodology was developed by a team from SNL with guidance and support 
from personnel at Langley Research Center (LaRC), Johnson Space Center (JSC), and Marshall 
Space Flight Center (MSFC). Participants in the assessment are listed in the team table in Section 
3.0. It should be emphasized that a general assessment methodology was developed and is not 
based on particular accident scenarios. It is anticipated that future analyses of specific accidents 
will follow the approach established by this methodology. 

This assessment methodology was based on: 

1 . Review of NASA documents which describe the Ares-1 Crew Launch Vehicle (CLV); 

2. Review of prior experimental programs which consider the potential for explosions 
resulting from the mixing of liquid oxygen (L02) and liquid hydrogen (LH2); 

3. Identification of generic accident scenarios to provide a focus for the development; 

4. Identification of the possible sequence of events corresponding to generic accident 
scenarios; 

5. Identification of the types of analyses required to predict the environments and resulting 
effects of hypothesized accidents; 

6. Identification of computational software suitable for the required simulations; and 

7. Requirements for the validation of predictions. It was not possible to develop a highly 
specific assessment methodology because precise accident scenarios details were not 
specified. 


NESC Request No.: NESC 07-029-E 


# 

NASA Engineering and Safety Center 
Technical Report 

Document #: 

RP-08-43 

Version: 

1.0 

Title: 

Explosion/Blast Dynamics for Constellation Launch 
Vehicles Assessment 

Page #: 

9 of 35 


To compensate for this lack of information, generic accident scenarios were identified which 
exhibit possible adverse effects on the Ares-1 CLV. It is believed that these scenarios cover a 
range of possible failure mechanisms and sequences of events that could produce explosion 
hazards. 

6.0 Description of the Problem and Proposed Solutions 

6.1 Description of Problem 

An assessment methodology is established for the quantitative prediction of physical 
environments and subsequent vehicle interactions associated with a potential blast environment 
resulting from an inadvertent release of liquid fuel and oxidant from the US of the Ares-1 CLV 
during ascent. This work is pursued under an agreement between SNL and the NESC. The 
methodology is based on the current Ares-1 configuration and proposed feasible accident 
scenarios [ref 1]. Feasible accident scenarios are to be defined by NASA. Hence, the 
development of an assessment methodology must be based on assumed, generic accident 
scenarios. The methodology described herein is intended to increase confidence in the 
assumptions, methods, and analyses that could be conducted to make key technical 
recommendations and decisions affecting vehicle design, crew survival, and ascent abort 
procedures relating to the survival from a blast environment. This includes defining best practice 
procedures for the characterization of explosion environments. 

For purposes of Launch Abort System (LAS) design for the Ares-1 system, there is a need to 
understand and characterize the potential explosion environment produced by a release of liquid 
propellant from the US. It is important to understand the environments associated with such a 
catastrophic failure in terms of the blast, debris, and thermal characteristics at the Crew Module 
(CM) during separation from the failing vehicle as part of the Launch Abort Vehicle. Both near- 
field and far-field initial blast properties must be considered. Key features of appropriate 
methodologies include defining the key physics that need to be modeled, determining 
appropriate inputs to these models, identifying appropriate modeling tools for simulation and 
defining the expected model outputs for characterizing the blast and transport of material and 
energy in relation to the interaction with the CM (or other parts of the vehicle). 

In discussing the potentially explosive environment, the terms explosion, detonation, and 
deflagration will be used and brief definitions of these terms are given in Section 12. More 
detailed definitions of these terms can be found in the book [ref. 2], by Kuo (1977). The focus of 
any methodology for the prediction of a propellant explosion necessarily centers on the release of 
hydrogen from the storage tank in the US and the subsequent mixing and reaction with oxygen 
causing rapid energy release. An initial analysis methodology was outlined and summarized in a 
PowerPoint presentation dated January 24, 2008. The associated slides are reproduced in 
Appendix A. This presentation forms the basis for the subsequent discussion of the developed 
methodology. 
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6.2 Overview of Methodology 

As stated above, the methodology to be described is based on the inadvertent release of 
propellants and the possible consequences associated with such a release. A meaningful 
prediction of a potential explosion event requires fundamentally that the entire sequence of 
processes associated with cryogenic tank rupture, venting, and mixing of the hydrogen with 
oxygen or ambient air be described in detail. A series of four steps is envisioned as a path to 
determining the consequences of a loss of containment of propellants that can occur either 
externally or internally to the stage structure: 

1 . Define the accident scenarios (NASA responsibility); 

2. Determine the initial conditions for a potential blast environment; 

3. Predict the pressure, impulse, thermal, and debris sources; and 

4. Determine the environment at the crew exploration vehicle (CEV). 

Each of these steps is described in the subsequent sections. Following identification of the 
fundamental steps, a summary of the general types of simulation software required for the 
proposed predictions is discussed and specific existing computational software packages are 
identified that are potentially suitable for the required simulations. 

6.2.1 Accident Scenarios 

Credible accidents that could result in the loss of containment of propellants include: 

1 . Debris from a solid rocket booster explosion breaching an exterior propellant tank wall; 

2. Debris lost from structures forward of the stage breaching an exterior propellant tank 
wall; 

3. Energy release sufficient to cause catastrophic rupture of propellant tanks; and 

4. Pressure imbalance between hydrogen and oxygen tanks leading to failure of the common 
bulkhead which separates the propellants. 

Since a specific accident scenario has not been identified, the proposed methodology is 
illustrated with reference to a sequence of events. Once specific accident scenarios have been 
identified, it is necessary to identify both the relevant physical processes to be addressed and 
specific computational software that can be used to provide useful simulations. 
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6.2.2 Initial Conditions for the Blast Environment 

Initial conditions leading to a potential blast environment are derived from the details of the 
accident scenarios, and include, but are not limited to: 

1 . Location on the US tanks where breach of the cryogenic tanks occurs; 

2. Modes of failure of the tank(s) ( e.g . holes, cracks or tears of material associated with 
rupture of the tanks) 

3. Availability of oxygen (e.g., ambient atmosphere and/or subsequent failure of liquid 
oxidant tank); 

4. Tank pressures and temperatures of the hydrogen, oxygen and/or ambient air determining 
the thermodynamic states associated with the mixing and stoichiometry of a potential 
combustion event; 

5. Confinement or the degree of intimate contact of the hydrogen-oxygen mixture 
determining whether a deflagration can evolve into a detonation; and 

6. Trajectory data including available fuel volume, relative vehicle velocity and ambient air 
free-field conditions. 

6.2.3 Pressure, Impulse, Thermal, and Debris Source Terms 

The pressure, impulse, thermal and debris environments, at selected altitudes, can be estimated 
upon specifying the above initial conditions. The existing White Sands Test Facility (WSTF) 
experimental data [ref. 3] (Bunker-Farrah, R, et al., 2002) provides much insight into propellant 
explosion behavior and measurements from these tests can provide guidance in estimating the 
combustion/energy release rates. However, to supplement this historical database, additional 
hydrogen/oxygen experiments may be needed to reflect conditions that are more relevant to 
expected accident conditions, i.e. rupture of a single compartment of the tank configuration that 
potentially causes subsequent failure of the auxiliary tank; failure of a common bulkhead; and/or 
dynamic environment effects. 

The essential ingredients of a potential explosion require that hydrogen and oxygen be brought 
together as either gases or liquids. Since these constituents are originally separated and stored as 
liquids, the turbulent mixing of these reactants must be modeled. Subsequently, the ignition of 
the mixture must then be considered. Based on prior work from WSTF, self ignition is likely to 
occur (without any external source) when the liquids first come in contact. Under conditions of 
weak confinement, the initial mixing and combustion behavior produces rapid gas formation and 
energy release that likely drives the propellants apart and impedes (rather than enhances) gross 
mixing of the non-premixed reactants. Typically, these reactive processes of liquid propellants 
produce rapid deflagrations rather than detonations and the blast waves from these explosions are 
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characterized by much lower source pressures and impulse than otherwise realized by high 
explosives of equivalent energy release. Hence, it is important to use an appropriate model for 
turbulent combustion with timescales that partition the energy release supporting blast vs. waste 
heat (volumetric combustion behavior) and reflects limited combustion behavior. For example, a 
volumetric energy source can be used in shock physics analysis to represent the turbulent 
combustion environment that induce blast effects due to distributed energy release [ref 4] (Ritzel, 
D.V. and Matthews, K., 1997). The fireball characteristics can be estimated using traditional 
existing correlations to determine the thermal environment [ref 5] (Baker, et al., 1983). The rate 
of energy release during the reaction detennines the pressure and the impulse at the CEV, as well 
as the characteristics of the ejected debris (i.e. a non-shock event should produce relatively large 
fragments moving at relatively low velocities). 

6.2.4 Environment at the CEV 

The environment at the CEV is detennined from analyses that define near- and far- field effects. 
The nature of the explosion event covers a broad range of time scales and the various aspects of 
relevant physics are weakly coupled. Hence, structural failure of the tanks, venting, mixing of the 
reactants, combustion, blast and structural response of the CEV can be modeled sequentially, 
using the output from one event as initial conditions for the next. A fully coupled fluid/structural 
analysis is likely not required and one-way coupling should be adequate in these assessments. 

The near-field effects include blast over-pressure/impulse, heat transfer and debris environment 
at the CEV while still attached to the US. The consequences of debris dispersal are determined 
by mass/velocity characteristics of the debris ejected from the US that intersects the CEV. The 
far-field effects include defining blast over-pressure/impulse, heat transfer, and debris 
environments at the CEV. In addition, the thermal and debris insults to the parachutes during an 
abort should be considered. Launch abort timing relative to an explosion is critical in order to 
determine the CEV environment. 

6.2.5 Simulation Softw are 

A broad spectrum of numerical analysis tools is required to perform the analyses described. A 
suggested list of computational codes is included in Table 6.2-1, where all software packages are 
available at SNL and an asterisk indicates SNL-developed software. It is anticipated that both 
commercially available and laboratory-developed software (SNL or elsewhere) w ill be required 
to perform the suite of simulations required to meet the requirements of the developed 
methodology in a timely manner. 
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Table 6.2-1. Summary of Computational Analysis Codes 


Code 

Analysis Capabilities 

FLOW3D; FLUENT 

Computational fluid dynamics / turbulent flow / mixing / 
reaction 

CHEETAH 

Define high pressure product EOS and thermo-chemistry 

CTH* 

Shock physics, blast environment, debris formation 

PRESTO*; JAS3D*; ABAQUS 

Structural mechanics 

CALORE*, COYOTE* 

Thermal analysis 

PREMO* 

Aerodynamics 


Computational fluid dynamics (CFD) ( e.g . FLOW3D, FLUENT) codes are required to assess the 
mixing and reaction of the released hydrogen with on-board oxygen and/or ambient air. The 
cryogenic fluids, hydrogen and oxygen, must change to mixed vapor phases in order to promptly 
react and this transformation likely occurs as a dense mixture. A chemical equilibrium code {e.g. 
CHEETAH) with non-ideal gas capability is needed to define the equation of state, thermo- 
chemistry, and energy release capabilities of the potentially dense state reactant mixture. The 
actual energy release is required in shock physics analysis codes {e.g. CTH) to determine blast 
environment (ullage pressure and impulse histories) and thermal field of the fireball. The 
consequent debris characterization and impact dynamics can also be estimated with the shock 
physics code. Structural, thermal, and aerodynamics codes {e.g. PRESTO, CALORE, PREMO, 
respectively) are also required to fully address the response to the blast environment. 

The required fidelity of simulations {i.e., level of detail in the models and physics required to 
assure that all the significant factors/geometry are included) must be detemiined. This 
investigation should include benchmark models and/or analyses of example past accidents. 

There is a wealth of hydrogen explosion experimental data available; however, not all of it may 
be relevant to a tank failure scenario. To gain some additional insight, the WSTF LH2/L02 data 
could be reanalyzed whereby a distributed energy release is modeled rather than treated as a 
point explosive source {i.e., volume explosion vs. high explosive (HE) detonation). Additional 
experiments could be conducted to gain an understanding of this blast environment whereby 
different breakup conditions of the propellant tanks are postulated that are more representative of 
actual mixing conditions. 

In addition to the expertise at SNL, consultation with outside expertise is likely to prove fruitful. 
For example, Professor J. E. Shepherd (Caltech) is an internationally recognized expert in 
hydrogen explosion/ blast characterization and has assisted SNL in several other prior studies of 
volumetric explosion behavior. 
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6.2.6 Summary 

The sequence of tasks to determine the consequences of propellant release (internal and/or 
external to the stage structure) is summarized as follows: 

1 . Define/assess the potential credible accidents that would release propellants and cause a 
subsequent explosion; 

2. Evaluate/interpret existing experimental data; 

3. Determine the initial conditions for propellant release and/or mixing derived from details 
of the accident scenarios; 

4. Identify the wide spectrum of computational tools required for the analyses; 

5. Determine the energy release and possible blast effects for the scenario(s) of interest; 

6. Use the blast environment to define both the near- and far-field pressure/impulse/debris 
effects; and 

7. Assess potential accident consequences on the CEV. 

6.3 Accident Scenario Considerations 

In section 6.2.1 a set of possible accident scenarios is listed; however, details and data needed for 
failure assessment ( i.e . debris propagation from the explosion of the First Stage solid propellant 
to the US) are not currently available. Hence, an alternate approach is to assume that the Second 
Stage propellant tanks are breached and omit consideration of the details of accidents that may 
adversely affect the tanks. Regardless of the scenario definition, the path of events leading to a 
potential explosion in the US, centers on breach of the propellant tanks and on the modes of 
failure that dictate how venting and mixing of the propellants subsequently occur. 

One proposed accident scenario is an “explosion” of the First Stage solid rocket motor which 
would create a source of debris that might impact the exterior of the US LH2 and/or L02 fuel 
tank walls. The credibility of this scenario depends on whether a debris trajectory intersects the 
US. The First Stage has a slightly smaller diameter than the US, and ejected debris does not have 
an unimpeded path to the exterior walls of the US. If at the time of the accident, the First Stage 
has rotated off the system axis relative to the US, a path intersection possibly exists. Under 
normal aligned conditions, analyses could determine if there are adequate aerodynamic forces on 
upward moving debris in a relatively downward- moving airstream that would change the 
trajectory of debris towards the US. hi particular, there may be some mechanism whereby 
reacting propellant fragments might be accelerated into the upper tank walls. In any case, 
fragments would have velocity components aligned with the longitudinal direction of the tanks, 
and would likely gash or crack the tank walls rather than puncture them. This failure mode could 
occur in either the liquid or ullage region of a tank. Since the propellant tanks are pressurized, a 
sudden loss in ullage pressure in one tank could lead to structural failure of the adjacent 
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propellant tank via the common bulkhead. Another possible outcome of a loss of pressure is a 
boiling liquid expanding vapor explosion, or BLEVE, [ref. 5] (Baker, et al., 1983). In such an 
event, the sudden drop in pressure inside a propellant tank causes violent boiling of the liquid 
propellant that liberates large amounts of vapor to potentially cause a secondary explosion. 

If the solid rocket motor propellant detonates, the motor case and propellant fragments are 
expected to be ejected at velocities >1 km/s. Debris dimensions in the vicinity of the detonation 
can be estimated with a fragmentation model [ref. 6], ( e.g ., Grady-Kipp, 1989). This method is 
more applicable in events where the energy is sufficiently high to produce many fragments than 
under other situations where only a few fragments form, such as tearing conditions. If the solid 
rocket motor case bursts under elevated internal pressure, the debris will be dispersed with much 
lower velocities than those of a detonation and the physical size of the debris fragments would be 
expected to be much greater than those produced by a detonation. 

In either a detonation or lower energetic “explosion” event, there will be shock waves 
transmitted to the US that could potentially cause an imbalance of pressure in the propellant 
tanks, and possible failure of the common bulkhead. This scenario would require a fairly detailed 
model of the intervening structure and components coupling the shock from the explosion to the 
US. Clearly, the details of the accident scenario have a major influence in determining the 
propagation path of failure mechanisms leading to the onset of a potential explosion of the liquid 
propellants. 

7.0 Proposed Analyses 

The following discussion describes analyses proposed to gain insight into accident scenarios in 
which either or both US tank(s) is/are perforated by debris fragment(s) originating from the First 
Stage or experience structural failure(s) caused by blast loading. The source of fragments and 
subsequent impacts are not considered in this discussion. The accident could occur at any time 
during the First Stage burn, so the US tanks are assumed to be fully loaded, with nominal ullage 
volumes and pressures. The oxygen tank is located aft of the hydrogen tank and separation of the 
tanks is maintained by a common bulkhead. There are five tank wall perforation scenarios, as 
illustrated in Figure 7.0-1, for which analysis paths should be pursued: 

1 . Perforation of the oxygen tank in the fluid region; 

2. Perforation of the oxygen tank in the ullage region; 

3. Perforation of the hydrogen tank in the fluid region; 

4. Perforation of the hydrogen tank in the ullage region, and 

5. Structural response to blast loading. Each of these scenarios is considered in turn. 
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Following the discussion of the individual scenarios, some brief considerations are considered 
that relate to the debris source and debris interaction with the propellant tanks. 


Venting of ullage 
gases in LH2 tank & 
mixing with air 


Release of LH2 & 
external mixing with 
atmospheric air and/or 
L02 upon subsequent N 
failure of L02 tanks 


Common bulkhead 
failure leading to 
mixing of L02 in LH2 N 
or LH2 in L02 


Venting of ullage 
gases in L02 tank 





L02 

tank 




Release of L02 

Figure 7.0-1. Possible Failure Locations in the US Propellant Tanks 


7.1 Perforation of the Oxygen Tank in the Liquid Region 

Perforation of the exterior oxygen tank wall in the fluid region could result in loss of liquid at a 
rate that depends on the internal fluid pressure and the size of the penetration opening(s). 
Structural analysis of the region surrounding these openings is necessary to determine whether 
there is sufficient pressure difference to enhance venting due to additional structural failure ( e.g . 
tearing). The flow of liquid oxygen into the airstream is not expected to lead immediately to an 
explosion since there is no fuel present. However, the loss of oxygen will increase the ullage 
volume, and if the ullage pressure cannot be maintained, rapid boiling of the oxygen could 
produce an imbalance of pressure across the common bulkhead. Structural analyses, 
complementing design modeling, are required to determine the consequences of this imbalance, 
and whether failure of the common bulkhead occurs. If the common bulkhead fails, a flow of 
hydrogen aft into the oxygen tank can occur, accompanied by boiling of the hydrogen and 
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intense turbulent mixing. This would potentially lead to formation of a highly reactive mixture. If 
auto-ignition occurs, rapid combustion and energy release will likely lead to complete tank wall 
failure. The time to failure depends on the initial size of the vent area and ullage pressure. 

7.2 Perforation of the Oxygen Tank in the Ullage Region 

Perforation of the exterior tank wall in the ullage region of the oxygen tank will result in venting 
of the ullage gas (helium and oxygen) into the airstream. If venting causes a rapid pressure loss, 
the oxygen could boil in this region and also vent the ullage gases. As in Section 7.1, the vented 
oxygen in the absence of hydrogen does not pose an explosion hazard, however, the resulting 
pressure imbalance across the common bulkhead must be analyzed to determine whether it fails 
and how much oxygen remains prior to the failure. Upon common bulkhead failure, the mixing 
of hydrogen with the remaining oxygen could form a combustible mixture. 

7.3 Perforation of the Hydrogen Tank in the Fluid Region 

Perforation of the exterior tank wall in the region of the liquid hydrogen fuel could result in flow 
of the hydrogen into the airstream, and rapid vaporization. A hydrogen-air mixture is 
combustible; however, the plume of vapor is likely to be fuel rich and would require an ignition 
source rather than being auto-catalytic. Hence, it is unclear when burning occurs and where the 
reacting plume(s) impinge on the aft structures. Failure of the ullage pressure would also result in 
boiling of the hydrogen into the ullage region that could cause a pressure imbalance across the 
common bulkhead. For this condition, the ullage gas in the oxygen tank is at higher pressure than 
the hydrogen, and it is assumed that ullage and oxygen will be forced into the liquid hydrogen 
should that failure of the common bulkhead occurs. The higher temperature of the oxygen causes 
the hydrogen to boil with intense turbulent mixing to form a combustible mixture. 

7.4 Perforation of the Hydrogen Tank in the Ullage Region 

Perforation of the exterior tank wall in the ullage region of the hydrogen tank could result in the 
venting of ullage gas into the airstream. If the vent rate is high, the loss in pressure could result 
in hydrogen boiling, and venting of the ullage gases. Ignition of this mixture could be possible, 
with potential of thermal damage to the exterior of the US, and possibly to the First Stage. If a 
pressure imbalance should occur, the scenario becomes similar to that of Section 7.3. 

7.5 Structural Response to Blast Loading 

Pressure impulse loading of the propellant tanks can possibly induce a structural response that 
results in failure of the internal common bulkhead or an external breach of either or both tanks. 
The consequences of an internal common bulkhead failure are discussed in Section 7.1 and the 
consequences of external breaches are considered in Sections 7.1-4. Detailed structural analyses 
are required to predict the responses to pressure loadings 
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7.6 Comments on Debris Interaction with Tanks and Energy Release 

In the scenario where the source of debris is from the First Stage, the angle at which the fragment 
must engage the US exterior wall is necessarily shallow, and damage area is more likely to be a 
gash rather than a simple clean entry that a projectile would inflict. Perforation is expected to 
lead eventually to rupture of the external tank wall and/or the common bulkhead, but this failure 
depends on pressure loss rates. Knowledge of design load thresholds for the common bulkhead is 
particularly important for consequences analyses if pressure imbalance develops across the 
common bulkhead. 

For a specified insult to a tank wall, a combination of fluid and structural code analyses are 
required to follow the sequence of flow and structural responses that determine the strength of 
the energy release of the hydrogen/oxygen mixture formed. If the mixture reaction is primarily a 
deflagration, then thermal analyses are required to ascertain the damage to the structure as well 
as the environment at the CEV. If the rate of formation and/or confinement leads to a reaction 
that transforms with sufficiently rapid energy release to create pressure and/or shock waves, then 
a shock code ( e.g ., CTH) must be employed to track the effects of the blast on the CEV. If timing 
of the event is such that the module is already in an escape mode, the thermal and pressure loads 
as a function of radial extent must be determined to assess consequences to the vehicle. 

7.7 Recommended Methodology/Integrated Analyses 

The NESC team describes the integrated analyses paths which constitute a recommended 
methodology for the assessment of generic accident scenarios. The overall methodology is 
depicted in the flowcharts given below in Figures 7.7-1 through 7.7-4 which serve to guide the 
subsequent discussion of the methodology. Consider Figure 7.7-1 which depicts the initial steps 
of the proposed analyses. It is necessary to define a suite of credible accident scenarios which 
affect the US and specify the initial conditions to be imposed on the US. For purposes of 
developing the methodology presented here, we have identified conceptual scenarios that address 
a foreseeable range of accident environments to which the US may be subjected. The general 
types of accidents are summarized in Section 6.2. 1 and include: 

• Debris from a solid rocket booster explosion penetrating one or both of the liquid 
propellant tanks. 

• Debris lost from structures forward of the US penetrating one or both of the liquid 
propellant tanks. 

• Blast, pressure, or impulse loading sufficient to cause breaching or catastrophic rupture of 
one or both liquid propellant tanks. 

• Blast, pressure, or impulse loading sufficient to cause internal barrier failure between the 
liquid propellant tanks. 
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The initial conditions applicable to the US must be determined for each of the general conceptual 
accident types. The specific accident scenarios that can result are identified in Section 7.0 as: 

1 . Perforation of the oxygen tank in the fluid region; 

2. Perforation of the of the oxygen tank in the ullage region; 

3. Perforation of the hydrogen tank in the fluid region; 

4. Perforation of the hydrogen tank in the ullage region; and 

5. Tank failure resulting from structural response to a blast or pressure loading. 

Prior to the analysis of specific scenarios, it is desirable to validate the simulation strategy to the 
extent possible against available experiments that address the mixing and subsequent reactions 
involving L02 and LH2. This activity is noted in Figure 7.7-1 as a supporting analysis linked to 
the main flowchart with a dashed line. 

There are three main paths of analysis identified in Figure 7.7-1 which depend on whether 
penetration of the L02 tank or LH2 tank occurs or whether failure is the result of a structural 
failure cause by pressure, impulse, or blast loading. In the following we summarize the steps in 
the analyses required to characterize the responses associated with each of the scenarios. 

Scenarios 1 and 2 : Perforation of the L02 tank in the fluid or ullage regions requires the 
analysis process depicted in Figure 7.7-2. The external venting process must be simulated to 
determine if oxygen merely vents to the exterior region or if the venting process induces 
additional structural response. If only venting to the exterior occurs, it may be assumed there are 
no adverse effects since there is no contact with the hydrogen confined in the LH2 tank. If it is 
determined that the venting process induces a structural response, then a structural analysis is 
required to determine if there is a subsequent structural failure that results in contact between the 
oxygen and hydrogen, e.g. a failure of the internal common bulkhead which separates L02 and 
LH2, or a failure of containment which results in contact of L02 and LH2 external to the US. 
When there is a structural failure that results in contact between the propellants, the mixing and 
phase change processes must be modeled. Simultaneous with the mixing process, it is necessary 
to simulate the combustion behavior to determine the ultimate response associated with the 
contact of the propellants or the possible contact of LH2 with atmospheric air. These simulations 
must span the possibilities from confined internal mixing to mixing external to the US or a 
combination of the two. Ultimately, the simulations can require considerations of dynamic 
structural response, transient turbulent, two-phase incompressible and compressible CFD, and 
reactive chemistry. The end result of the simulation process is a prediction of pressure, impulse, 
blast, and thermal environments produced by the envisioned accident scenario. Computational 
software available for the required simulations (and those discussed subsequently) is listed in 
Table 6.2-1. 
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Scenarios 3 and 4 : Perforation of the LH2 tank in the fluid or ullage regions requires the 
analysis process depicted in Figure 7.7-3. The analysis procedure and required simulations are 
the same as those discussed in regard to Scenarios 1 and 2, except in one aspect. The only 
difference is that for Scenarios 3 and 4 external mixing of hydrogen with atmospheric air must be 
considered when only an external venting occurs. The analysis path for external venting requires 
the same steps encountered for any of the mixing processes identified. When external mixing 
occurs, aerodynamic effects can be important which require additional considerations regarding 
CFD simulation. 

Scenario 5 : Structural failure caused by pressure, impulse, or blast loading requires the analysis 
process depicted in Figure 7.7-4. In this scenario, detailed structural simulations are required to 
predict likely failure modes. The propellants can be brought into contact externally or internally, 
depending on the mode of structural failure. Mixing and reactive processes can thus occur 
between the propellants external or internal to the US. In addition, external mixing and reaction 
may occur between LH2 and atmospheric oxygen. 

Comment on External Mixing : Although not specifically included as a separate scenario in 
Scenarios 1-4, it is possible that L02 and LH2 tanks are breached externally at essentially the 
same time thus leading to the need to consider mixing of the propellants external to the US. This 
type mixing has been included as part of Scenario 5. In any proposed scenario, it is reasonable to 
determine if there is a possibility for contact of the propellants external to the US. A high degree 
of dilution is anticipated for any leakage of propellants into the external environment and results 
from the high relative velocity between the US and the atmosphere and the rapid phase changes 
associated with propellant tank blow-down. It seems likely that a simulation, based on a worst 
case external mixing scenario, could determine if there is any likelihood of an adverse 
environment resulting from external mixing. If it is determined that no adverse environment can 
be produced, it may not be necessary to include simulations of external mixing in any of the 
other scenarios. 
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Figure 7.7-1. Initial Analysis Path 
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Figure 7.7-2. Analysis Path for L02 Tank Failure 
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Figure 7.7-3. Analysis Path for LH2 Tank Failure 
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Figure 7.7-4. Analysis Path for Structural Failure 
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8.0 Findings, Observations, and Recommendations 

8.1 Findings 

There are no findings in this assessment. 

8.2 Observations 

The methodologies described in this report are based on five scenario pathways. Specifically, the 

NESC team considered the following: 

1 . Perforation of the oxygen tank in the fluid region; 

2. Perforation of the oxygen tank in the ullage region; 

3. Perforation of the hydrogen tank in the fluid region; 

4. Perforation of the hydrogen tank in the ullage region; and 

5. Tank failure resulting from the structural response to blast loading. 

Collectively, the scenarios include external and internal contact between the LH2 and L02 

propellants and between LH2 and atmospheric oxygen. 

O- 1 The design of methodologies for the analysis of accidents involving release of propellants 

from the ARES-1 crew launch vehicle requires a detailed knowledge of accident 
scenarios including tank rupture, venting, mixing, and reaction behavior. 

0-2 In the absence of detailed knowledge of accident scenarios, hypothetical, generic, 

accident scenarios must be specified to guide the development of methodologies for the 
assessment of accident environments and effects on the CLV. 

0-3 The assessment of the environment produced by tank rupture depends on the time 

evolution of venting, mixing, and chemical reactions of the propellants. Ultimately, it 
must be determined if an explosive or combustible environment can occur and, if so, the 
anticipated characteristics of the resulting energy release. Numerical simulations can 
provide guidance to assess the physical processes involved in accident scenarios. 

0-4 Existing experimental data for L02 and LH2 interactions should be consulted to guide 
the development of predictive methodologies for accident analyses. Once specific 
analyses techniques have been identified, existing experimental data should be used for 
validation. 
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8.3 Recommendations 

In order to establish a quantitative prediction of physical environments and subsequent vehicle 

interactions associated with a potential blast environment resulting from an inadvertent release of 

liquid fuel and oxidant from the US of the ARES-1 CLV during ascent, the following are 

recommended: 

a. Define a suite of credible accident scenarios which affect the US and specify the 
initial conditions to be imposed on the US. 

b. Prior to the analysis of specific scenarios, validate the simulation strategy to the 
extent possible against available experiments that address the mixing and 
subsequent reactions involving L02 and LH2. 

c. Conduct the accident analysis for each defined scenario, following the appropriate 
path of analysis as depicted in figure 7-7. 1 through 7-7.4. 

9.0 Alternate Viewpoints 

There were no alternate viewpoints expressed during this assessment. 

10.0 Other Deliverables 

There were no other deliverables for this assessment. 

11.0 Lessons Learned 

There were no lessons learned at this time. 

12.0 Definitions of Terms 


Combustion A reactive process between a fuel and an oxidant that undergoes a 

sequence of chemical transformations that produces product gases at 
high temperature. 

Computational Code A set of mathematical and logical steps written in a computer language 

that translates these rules to electronic instructions in a computer. 


Computational Fluid 

Dynamics A branch of science whereby numerical methods are used to analyze 

the effects of fluid dynamics. 
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Deflagration A subsonic combustion wave that propagates by thermal diffusion 

effects and generates relatively low pressure rise. 

Detonation A supersonic combustion wave that propagates by shock compression 

and generates a locally high pressures. 


Explosion 


Finding 


A combustion event that causes a sudden release of energy to produce 
a rapid expansion of high temperature gaseous products and 
subsequently high pressures and/or shock waves. 

A conclusion based on facts established by the investigating authority. 


Impulse The integral of pressure with respect to time. Impulse is a measure of 

the change in momentum imparted by a pressure load. 

Lessons Learned Knowledge or understanding gained by experience. The experience 

may be positive, as in a successful test or mission, or negative, as in a 
mishap or failure. A lesson must be significant in that it has real or 
assumed impact on operations; valid in that it is factually and 
technically correct; and applicable in that it identifies a specific 
design, process, or decision that reduces or limits the potential for 
failures and mishaps, or reinforces a positive result. 

Methodology A procedure or set of procedures that includes methods, rules, 

postulates and analysis principles followed in assessing a problem of 
inquiry. 

Observation A factor, event, or circumstance identified during the assessment that 

did not contribute to the problem, but if left uncorrected has the 
potential to cause a mishap, injury, or increase the severity should a 
mishap occur. Alternatively, an observation could be a positive 
acknowledgement of a Center/Program/Project/Organization’s 
operational structure, tools, and/or support provided. 

Problem The subject of the independent technical assessment/inspection. 


Recommendation An action identified by the assessment team to correct a root cause or 

deficiency identified during the investigation. The recommendations 
may be used by the responsible Center/Program/Project/Organization 
in the preparation of a corrective action plan. 
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Shock Physics Shock physics is the field of study involving the physical and chemical 

behavior of materials when subjected to very rapid and large 
compressions. 

Simulation Software A computational code that models a real-life or hypothetical situation 

on a computer. 

13.0 Acronyms List 

CEV Crew Exploration Vehicle 

CFD Computational Fluid Dynamics 

CLV Crew Launch Vehicle 

CM Crew Module 

HE High Explosive 

JSC Johnson Space Center 

LH2 Liquid Hydrogen 

L02 Liquid Oxygen 

NASA National Aeronautics and Space Administration 

NESC NASA Engineering and Safety Center 

NRB NESC Review Board 

SNL Sandia National Laboratories 

US Upper Stage 

WSTF White Sands Test Facility 
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Volume II: Appendix 

Appendix A. Proposed Methodology for Analysis of CLV Vulnerability to 

Propellant Explosions 



Proposed Methodology for Analysis 
of CLV Vulnerability to Propellant 
Explosions 


M. R. Baer, D. A. Crawford, E. S. Hertel , 
C.E. Hickox& M. E. Kipp 

Sandia National Laboratories 
Albuquerque, New Mexico 


January 24, 2008 


Sandia is a m u Kip ro gram laboratory operated by Sandia Corporation, a Lockheed Martin Company, 
for the United States Department of Energy under contract DE-AC 04- 94AL8 5000. 
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► Puri 


urpose and Scope of Work for CLV 


• Purpose 

- Understand the potential explosion environment produced by a 
release of hydrogen from the upper stage 

• Scope of Work 

- Recommend methodology for quantitatively characterizing the 
hydrogen explosion source term 

- Define the path to characterize consequent blast, thermal, and 
debris environments from CLV on the crew exploration vehicle 

• ARES-1 configuration and credible accident scenarios to be 
provided by NASA 


® Sanda 
National 
Laboratories 


Overview of Methodology 


• Expected sequence of tasks to determine the consequences of 
hydrogen release (internal and/or external to stage structure) 



® Sandia 
National 
lahorator 
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Define Accident Scenarios (NASA) 


Define potential credible accidents that could release hydrogen 


• Examples 

- Debris from solid rocket booster explosion breaching exterior 
hydrogen tank wall 

- Debris lost from structures forward of stage breaching exterior 
hydrogen tank wall 


- Hydrogen leak internal to walls reacting with atmospheric 
oxygen; energy release potential to cause catastrophic rupture 
of both hydrogen and oxygen tanks 


- Pressure imbalance between hydrogen and oxygen tanks 
leading to barrier failure 

• Scenario defined by NASA tasked to illustrate analysis path and 
timeline for assessment 


- Identity relevant aspects of physics to be addressed 

- Identify specific codes and outputs from analysis 

® Santiia 

SSL 


Conditions Leading to a Potential Blast 
Environment 


• Initial conditions derived from details from accident scenarios 

- Location of hydrogen release 

- Availability of oxygen ( e.g ., ambient atmosphere, liquid from 
tank) 

- Rate and duration of flow, temperature(s) of fuel and 
environment (determines mixing conditions and stoichiometry of 
combustion event) 

- Confinement 

- Trajectory location (determines available fuel volumes, vehicle 
velocity and ambient environments) 


@ Sandia 
National 
Laboratories 
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Pressure / Impulse / Thermal / Debris Source Terms 


• Initial conditions provide basis for determining source terms (most 
likely at selected altitudes) 


- Utilize WSTF experimental data to provide additional basis for 
combustion / energy release rates 

- Recommend a few additional hydrogen / oxygen experiments 
more relevant to expected accident conditions - (i.e, breach of 
single tanks; influence of propellant spill rates; dynamic 
environment effects) 

- This is primarily a turbulent flow mixing problem, not a 
detonation event 


Use statistical distribution for turbulent combustion wrt:h 
timescale of partition of energy release supporting blast vs. 
waste heat (volumetric combustion behavior) 

- Fireball characteristics based on existing correlations to 
determine thermal environment 

- Pressure / impulse 

- Debris (non-shock event should result in relatively large 
fragments at low velocities) 


3D 


Sandia 

National 

Laboratories 


Environment at Crew Vehicle 


• Source term will define near- and far-field effects 

- Coupled fluid / structural analyses probably not required and 
one-way coupling expected to be adequate 

• Separate calculations of the blast and the effects on structures 

- Near field: Blast over-pressure / impulse and heat transfer 
environment at crew vehicle still attached 

(Need to determine if debris can intersect crew vehicle) 

- Far field: Blast over-pressure/ impulse, heat transfer, and debris 
environment at crew vehicle / parachutes 

(Launch abort timing relative to explosion critical in order to 
determine environment) 


® Sandia 
National 
Laboratories 
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Codes and Data 


• Computational tools 

- Computational fluid dynamics / turbulent flow codes to analyze mixing / 
reaction of hydrogen with on-board oxygen and/or ambient atmosphere 

• (FLOW3D or FLU ENT to assess fluid mixing of propellants and CTH to 
assess release from high pressure reaction products) 

- Chemical equilibrium code with nonideal gas capability to define 
equation of state and energy release 

• (CHEETAH to define high pressure product EOS and thermochemistry) 

- Shock physics analysis codes to determine blast environment 
(overpressure and impulse histories) and thermal field of fireball 

• (CTH to determine the shock consequences of the blast field; debris 
formation and impact dynamics) 

- Structural and aerodynamics codes to address response to blast 
environment 

• (PRESTO structural mechanics analysis; CALORE thermal analysis; 

PREMO aerodynamics analysis) 

- Will have to determine fidelity of simulations required (/ e. , level of detail 
in the models and physics required to have confidence that all the 
significant factors / geometry have been included) 

- Benchmark models / analyses to examples of past accidents 

® Sands 

SSL 



Experimental & Consultation 

• Experimental data 

- Reanalyze some of the WSTF LH 2 / L0 2 data in 
relation to this environment (/&, volume explosion vs. 
detonation) 

- Additional experiments may prove vital to 
understanding this blast environment 

• breakup of propellant tanks 

• better characterization of mixing conditions 

• Consultation 

- ( i.e . Prof. J. E. Shepherd, Caltech, explosion / blast 
expert) 

• Laboratory experiments and volumetric explosion expertise 

® Sandia 
National 
Laboratoi 
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Summary of Methodology 


Sequence of tasks to determine consequences of hydrogen release 
(internal and/or external to the stage structure) 

• Define / assess potential credible accidents that would cause 
release of hydrogen and subsequent explosion 

• Evaluate / interpret existing experimental data 

• Determine initial conditions of fuel release and / or mixing derived 
from details of accident scenarios 

• Determine energy release / blast effects for scenario of interest 

• Blast environment defines near- and far-field pressure / impulse / 
debris effects 

• Wide spectrum of computational tools brought to bear on analysis 

• Assessment of the potential accident consequence on the crew 
exploration vehicle 

® Sandia 

ass 
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